Innovation at the ACCURATE retreat

During yesterday's ACCURATE retreat we got to see what everyone was working on in their elections-related research. There was a lot of neat stuff, especially from David Wagner's group. Wagner's group (including Ping, David, Arel, Naveen and Yoshi Kohno) are working on ideas like low-fi random number generation, hardware isolation of subsystems, an electronic vote storage device that is tamper-evident and preserves privacy and reducing UI code -- the bulk of voting system code -- to a very small core that is easily auditable.

David Chaum, an ACCURATE affiliate, gave a short and fascinating presentation and demonstration of his new Punchscan method of voting. Here's the idea:

[More:]

There are two ballots; an upper ballot and a lower (here's a PDF sample ballot). The upper ballot has holes punched in it through which colored letters can be seen. The voter uses a bingo dauber to mark their choice in each race. The dauber end is larger than the hole in the paper so making a selection leaves a mark on lower ballot as well as around the edge of the hole on the upper ballot.

The idea is that you can take one of the ballots home with you and the other is counted via optical scan. Later, the local elections official can post an image of the ballot, upper or lower, that the voter took home and the voter can use this to verify that their vote was counted and counted correctly (or the image won't look like what they've taken home).

The letters and positions of the choices are shuffled for each ballot so there's no way to identify how a voter voted unless you have both the upper and lower ballot. Only the election official (that printed the ballots and saved this information to count the ballots later) can associate marks on a ballot with certain choices.

Further, this allows real privacy for people with disabilities for optical scan voting. Disabled voters don't have to tell someone their votes and hope they fill out the ballot accordingly (which can mean that the voter doesn't have any privacy and can't make choices free from influence). Instead, they can use an audio ballot that tells them what the letters on the bottom ballot correspond to. They then tell the letters they have chosen to someone who can fill out the bottom ballot for them... if the voter doesn't reveal the audio tape to the person filling out the ballot for them, that person will never know the voter's choices.